URL:

https://mega.nz/file/EhhwUZpB#DzLPbyVUc7DcOgf3NQsEnuJg7Mi6-VmDA7QDuxhoELE

Full analysis: https://app.any.run/tasks/8a969b18-d713-42db-8bc7-7ff563300884
Verdict: Malicious activity
Threats:

Blank Grabber is an infostealer written in Python. It is designed to steal a wide array of data, such as browser login credentials, crypto wallets, Telegram sessions, and Discord tokens. It is an open-source malware, with its code available on GitHub and regularly receiving updates. Blank Grabber builder’s simple interface lets threat actors even with basic skills to deploy it and conduct attacks.

Malware Trends Tracker     >>>
Analysis date: December 11, 2024, 13:04:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
sfx
dropper
stealer
github
screenshot
python
evasion
discord
blankgrabber
telegram
Indicators:
MD5:

3704028B5958E077AB6C1EEEDDFAB1D8

SHA1:

44B4FEEF1AADFD43493A254057EAD45C801C7052

SHA256:

EEB9AC172071C1148346DA00A3579760DDE82F40761784A2F27A6889B2537936

SSDEEP:

3:N8X/ipDl88zb2CGa:2gDlbzbl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Detects Cygwin installation

      • General_install.exe (PID: 7428)

    • SFX dropper has been detected

      • Build.exe (PID: 6608)

    • Executing a file with an untrusted certificate

      • hacn.exe (PID: 6568)
      • based.exe (PID: 6564)
      • based.exe (PID: 6376)
      • hacn.exe (PID: 6364)
      • CompPkgSrv.exe (PID: 7188)
      • crss.exe (PID: 4876)
      • crss.exe (PID: 7820)
      • CompPkgSrv.exe (PID: 7064)

    • Adds path to the Windows Defender exclusion list

      • based.exe (PID: 6376)
      • cmd.exe (PID: 6340)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 7956)
      • MpCmdRun.exe (PID: 4120)

    • Changes settings for real-time protection

      • powershell.exe (PID: 6164)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 6164)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 6164)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 6164)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 6164)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 6164)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 6164)

    • Actions looks like stealing of personal data

      • based.exe (PID: 6376)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 3912)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6700)

    • Resets Windows Defender malware definitions to the base version

      • MpCmdRun.exe (PID: 4120)

    • BLANKGRABBER has been detected (SURICATA)

      • System (PID: 4)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1412)

    • Changes the autorun value in the registry

      • ChainComServermonitor.exe (PID: 6416)

    • Changes the login/logoff helper path in the registry

      • ChainComServermonitor.exe (PID: 6416)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • General_install.exe (PID: 7428)

    • Executable content was dropped or overwritten

      • General_install.exe (PID: 7428)
      • Installer.exe (PID: 7920)
      • Build.exe (PID: 6548)
      • hacn.exe (PID: 6568)
      • based.exe (PID: 6564)
      • csc.exe (PID: 488)
      • jttWsjba.exe (PID: 2224)
      • s.exe (PID: 7664)
      • CompPkgSrv.exe (PID: 7188)
      • crss.exe (PID: 4876)
      • svchost.exe (PID: 1220)
      • ChainComServermonitor.exe (PID: 6416)
      • csc.exe (PID: 7432)
      • csc.exe (PID: 6896)
      • csc.exe (PID: 7452)
      • csc.exe (PID: 5240)
      • ctfmon.exe (PID: 7032)
      • setup.exe (PID: 3912)

    • Reads security settings of Internet Explorer

      • General_install.exe (PID: 7428)
      • s.exe (PID: 7664)
      • ChainComServermonitor.exe (PID: 6416)

    • Reads the date of Windows installation

      • General_install.exe (PID: 7428)

    • Starts CMD.EXE for commands execution

      • General_install.exe (PID: 7428)
      • powershell.exe (PID: 5788)
      • Installer.exe (PID: 7488)
      • based.exe (PID: 6376)
      • hacn.exe (PID: 6364)
      • cmd.exe (PID: 1556)
      • jttWsjba.exe (PID: 7836)
      • wscript.exe (PID: 1412)
      • CompPkgSrv.exe (PID: 7064)
      • ChainComServermonitor.exe (PID: 6416)

    • Executing commands from a ".bat" file

      • General_install.exe (PID: 7428)
      • powershell.exe (PID: 5788)
      • wscript.exe (PID: 1412)
      • ChainComServermonitor.exe (PID: 6416)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 6476)
      • net.exe (PID: 3840)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5556)
      • cmd.exe (PID: 6184)
      • cmd.exe (PID: 4972)
      • cmd.exe (PID: 6864)
      • cmd.exe (PID: 7640)
      • cmd.exe (PID: 396)
      • cmd.exe (PID: 4428)
      • cmd.exe (PID: 5200)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6476)
      • cmd.exe (PID: 6340)
      • cmd.exe (PID: 7956)
      • cmd.exe (PID: 7228)
      • cmd.exe (PID: 3912)
      • cmd.exe (PID: 3188)
      • cmd.exe (PID: 7400)
      • cmd.exe (PID: 6016)
      • cmd.exe (PID: 7892)

    • Starts process via Powershell

      • powershell.exe (PID: 5788)

    • The process drops C-runtime libraries

      • Installer.exe (PID: 7920)
      • hacn.exe (PID: 6568)
      • based.exe (PID: 6564)
      • jttWsjba.exe (PID: 2224)
      • CompPkgSrv.exe (PID: 7188)
      • crss.exe (PID: 4876)

    • Process drops legitimate windows executable

      • Installer.exe (PID: 7920)
      • Build.exe (PID: 6548)
      • based.exe (PID: 6564)
      • hacn.exe (PID: 6568)
      • jttWsjba.exe (PID: 2224)
      • CompPkgSrv.exe (PID: 7188)
      • crss.exe (PID: 4876)
      • ChainComServermonitor.exe (PID: 6416)

    • Process drops python dynamic module

      • Installer.exe (PID: 7920)
      • based.exe (PID: 6564)
      • hacn.exe (PID: 6568)
      • jttWsjba.exe (PID: 2224)
      • CompPkgSrv.exe (PID: 7188)
      • crss.exe (PID: 4876)

    • Application launched itself

      • Build.exe (PID: 6608)
      • Installer.exe (PID: 7920)
      • based.exe (PID: 6564)
      • hacn.exe (PID: 6568)
      • cmd.exe (PID: 1556)
      • jttWsjba.exe (PID: 2224)
      • crss.exe (PID: 4876)
      • CompPkgSrv.exe (PID: 7188)

    • The executable file from the user directory is run by the CMD process

      • Build.exe (PID: 6608)
      • rar.exe (PID: 6244)
      • s.exe (PID: 7664)
      • ChainComServermonitor.exe (PID: 6416)

    • Loads Python modules

      • based.exe (PID: 6376)
      • hacn.exe (PID: 6364)
      • jttWsjba.exe (PID: 7836)

    • Found strings related to reading or modifying Windows Defender settings

      • based.exe (PID: 6376)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 6340)

    • Script disables Windows Defender's IPS

      • cmd.exe (PID: 7956)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 7956)

    • Get information on the list of running processes

      • based.exe (PID: 6376)
      • cmd.exe (PID: 2680)
      • cmd.exe (PID: 1140)
      • cmd.exe (PID: 2008)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6016)
      • cmd.exe (PID: 7116)
      • cmd.exe (PID: 4228)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 3912)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 5748)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3912)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 3912)

    • Accesses antivirus product name via WMI (SCRIPT)

      • WMIC.exe (PID: 6208)

    • Captures screenshot (POWERSHELL)

      • powershell.exe (PID: 6700)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 488)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 6912)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 6672)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 8096)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 4132)
      • WMIC.exe (PID: 8088)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 6872)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 5888)

    • Potential Corporate Privacy Violation

      • hacn.exe (PID: 6364)
      • crss.exe (PID: 7820)
      • System (PID: 4)

    • Checks for external IP

      • System (PID: 4)
      • svchost.exe (PID: 2192)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • based.exe (PID: 6376)
      • System (PID: 4)
      • CompPkgSrv.exe (PID: 7064)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1412)

    • Creates file in the systems drive root

      • crss.exe (PID: 7820)
      • CompPkgSrv.exe (PID: 7064)

    • Executed via WMI

      • schtasks.exe (PID: 6976)
      • schtasks.exe (PID: 5096)
      • schtasks.exe (PID: 8084)
      • schtasks.exe (PID: 6628)
      • schtasks.exe (PID: 6904)
      • schtasks.exe (PID: 6368)
      • schtasks.exe (PID: 6512)
      • schtasks.exe (PID: 6456)
      • schtasks.exe (PID: 6392)
      • schtasks.exe (PID: 6320)
      • schtasks.exe (PID: 4648)
      • schtasks.exe (PID: 6820)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 6336)

    • The process creates files with name similar to system file names

      • ChainComServermonitor.exe (PID: 6416)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 4648)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5200)

    • Manipulates environment variables

      • powershell.exe (PID: 2392)

    • Connects to unusual port

      • crss.exe (PID: 7820)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6516)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6196)

    • Connects to the server without a host name

      • System (PID: 4)
      • crss.exe (PID: 7820)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2572)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 2144)
      • firefox.exe (PID: 2624)

    • Manual execution by a user

      • WinRAR.exe (PID: 2076)
      • General_install.exe (PID: 7428)
      • Taskmgr.exe (PID: 7012)
      • notepad.exe (PID: 7096)
      • General_install.exe (PID: 7284)
      • Installer.exe (PID: 7920)
      • Taskmgr.exe (PID: 1512)
      • dialer.exe (PID: 2428)
      • cmd.exe (PID: 6516)
      • schtasks.exe (PID: 6196)
      • schtasks.exe (PID: 2120)
      • schtasks.exe (PID: 1572)
      • powershell.exe (PID: 2392)

    • The process uses the downloaded file

      • firefox.exe (PID: 2624)
      • WinRAR.exe (PID: 2076)
      • Build.exe (PID: 6548)
      • s.exe (PID: 7664)
      • svchost.exe (PID: 1220)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2076)

    • The sample compiled with english language support

      • General_install.exe (PID: 7428)
      • Build.exe (PID: 6548)
      • Installer.exe (PID: 7920)
      • based.exe (PID: 6564)
      • hacn.exe (PID: 6568)
      • jttWsjba.exe (PID: 2224)
      • crss.exe (PID: 4876)
      • CompPkgSrv.exe (PID: 7188)
      • ChainComServermonitor.exe (PID: 6416)

    • Checks supported languages

      • General_install.exe (PID: 7428)
      • chcp.com (PID: 4244)
      • Build.exe (PID: 6548)
      • hacn.exe (PID: 6568)
      • hacn.exe (PID: 6364)
      • tree.com (PID: 4516)
      • tree.com (PID: 6488)
      • csc.exe (PID: 488)
      • cvtres.exe (PID: 7792)
      • MpCmdRun.exe (PID: 4120)
      • jttWsjba.exe (PID: 2224)
      • CompPkgSrv.exe (PID: 7188)
      • s.exe (PID: 7664)
      • crss.exe (PID: 7820)
      • ChainComServermonitor.exe (PID: 6416)
      • CompPkgSrv.exe (PID: 7064)
      • cvtres.exe (PID: 5912)
      • csc.exe (PID: 6896)
      • cvtres.exe (PID: 7920)
      • chcp.com (PID: 4132)
      • ctfmon.exe (PID: 7032)
      • crss.exe (PID: 4876)

    • Process checks computer location settings

      • General_install.exe (PID: 7428)
      • Build.exe (PID: 6548)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5556)
      • cmd.exe (PID: 5200)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7012)
      • WMIC.exe (PID: 6912)
      • WMIC.exe (PID: 5888)

    • UPX packer has been detected

      • winws.exe (PID: 6380)

    • Reads the computer name

      • hacn.exe (PID: 6568)
      • hacn.exe (PID: 6364)
      • jttWsjba.exe (PID: 2224)
      • s.exe (PID: 7664)
      • CompPkgSrv.exe (PID: 7188)
      • svchost.exe (PID: 1220)
      • ChainComServermonitor.exe (PID: 6416)
      • CompPkgSrv.exe (PID: 7064)

    • Create files in a temporary directory

      • Installer.exe (PID: 7920)
      • based.exe (PID: 6564)
      • hacn.exe (PID: 6568)
      • based.exe (PID: 6376)
      • jttWsjba.exe (PID: 2224)
      • crss.exe (PID: 4876)
      • CompPkgSrv.exe (PID: 7188)
      • ChainComServermonitor.exe (PID: 6416)
      • cvtres.exe (PID: 5912)
      • cvtres.exe (PID: 7492)

    • Reads the machine GUID from the registry

      • hacn.exe (PID: 6364)
      • csc.exe (PID: 488)
      • rar.exe (PID: 6244)
      • crss.exe (PID: 7820)
      • CompPkgSrv.exe (PID: 7064)
      • csc.exe (PID: 5240)
      • csc.exe (PID: 6896)

    • Checks operating system version

      • hacn.exe (PID: 6364)
      • CompPkgSrv.exe (PID: 7064)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 1988)

    • Checks the directory tree

      • tree.com (PID: 6488)
      • tree.com (PID: 4516)
      • tree.com (PID: 7544)
      • tree.com (PID: 776)
      • tree.com (PID: 4804)
      • tree.com (PID: 7760)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6448)
      • powershell.exe (PID: 6164)
      • powershell.exe (PID: 2392)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6448)
      • powershell.exe (PID: 6164)
      • powershell.exe (PID: 7152)
      • powershell.exe (PID: 7264)
      • powershell.exe (PID: 2392)

    • Checks proxy server information

      • hacn.exe (PID: 6364)
      • crss.exe (PID: 7820)

    • Displays MAC addresses of computer network adapters

      • getmac.exe (PID: 4580)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2192)
      • based.exe (PID: 6376)
      • System (PID: 4)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • svchost.exe (PID: 1220)
      • wscript.exe (PID: 1412)

    • Creates files in the program directory

      • ChainComServermonitor.exe (PID: 6416)
      • csc.exe (PID: 7432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
337
Monitored processes
203
Malicious processes
30
Suspicious processes
6

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe rundll32.exe no specs general_install.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs chcp.com no specs net1.exe no specs winws.exe no specs powershell.exe no specs winws.exe no specs winws.exe conhost.exe no specs cmd.exe conhost.exe no specs taskmgr.exe no specs taskmgr.exe notepad.exe no specs general_install.exe no specs installer.exe installer.exe no specs cmd.exe no specs conhost.exe no specs #DROPPER build.exe no specs build.exe hacn.exe based.exe based.exe hacn.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs tree.com no specs systeminfo.exe no specs cmd.exe no specs conhost.exe no specs tree.com no specs cmd.exe no specs conhost.exe no specs tree.com no specs cmd.exe no specs conhost.exe no specs tree.com no specs cmd.exe no specs conhost.exe no specs tree.com no specs cmd.exe no specs conhost.exe no specs tree.com no specs csc.exe tiworker.exe no specs cvtres.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs getmac.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs rar.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs svchost.exe #BLANKGRABBER system cmd.exe no specs conhost.exe no specs cmd.exe no specs jttwsjba.exe jttwsjba.exe no specs cmd.exe no specs conhost.exe no specs s.exe comppkgsrv.exe crss.exe svchost.exe setup.exe wscript.exe no specs crss.exe cmd.exe no specs conhost.exe no specs chaincomservermonitor.exe comppkgsrv.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs reg.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe no specs conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs ctfmon.exe powershell.exe conhost.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs dialer.exe schtasks.exe conhost.exe no specs schtasks.exe conhost.exe no specs schtasks.exe conhost.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4System
[System Process]
User:
SYSTEM
Integrity Level:
SYSTEM
396C:\WINDOWS\system32\cmd.exe /c "tree /A /F"C:\Windows\System32\cmd.exe—based.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
488"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ktxmokkv\ktxmokkv.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
776tree /A /FC:\Windows\System32\tree.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Tree Walk Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tree.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1140C:\WINDOWS\system32\cmd.exe /c "tasklist /FO LIST"C:\Windows\System32\cmd.exe—based.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1220"C:\ProgramData\svchost.exe" C:\ProgramData\svchost.exe
s.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1412"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe" C:\Windows\SysWOW64\wscript.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
94 669
Read events
94 604
Write events
64
Delete events
1

Modification events

(PID) Process:(2624) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\Password_css.rar
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
312
Suspicious files
200
Text files
190
Unknown types
17

Dropped files

PID
Process
Filename
Type
2624firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2624firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:C95DDC2B1A525D1A243E4C294DA2F326
SHA256:3A5919E086BFB31E36110CF636D2D5109EB51F2C410B107F126126AB25D67363
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
2624firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2624firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
294
DNS requests
112
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2624
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2624
firefox.exe
POST
—
195.138.255.18:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
2624
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
2624
firefox.exe
POST
—
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
2624
firefox.exe
POST
—
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
2624
firefox.exe
POST
200
195.138.255.18:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
2624
firefox.exe
POST
200
195.138.255.18:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
184.24.77.35:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5856
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2624
firefox.exe
34.117.188.166:443
contile.services.mozilla.com
—
—
whitelisted
2624
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
2624
firefox.exe
172.217.18.10:443
safebrowsing.googleapis.com
—
—
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 184.24.77.35
  • 184.24.77.37
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.184
  • 104.126.37.179
  • 104.126.37.137
  • 104.126.37.171
  • 104.126.37.130
  • 104.126.37.170
  • 104.126.37.128
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
mega.nz
  • 31.216.144.5
  • 31.216.145.5
  • 2a0b:e46:1:144::5
  • 2a0b:e46:1:145::5
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.215.14
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
2192
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
2192
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
2624
firefox.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
2624
firefox.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
2192
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2192
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2192
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2192
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2192
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/file/EhhwUZpB#DzLPbyVUc7DcOgf3NQsEnuJg7Mi6-VmDA7QDuxhoELE